12.5. Tracking Certificates with certmonger
certmongercan monitor expiration date of a certificate and automatically renew the certificate at the end of its validity period. To track a certificate in this way, run the
It is not required that you run
getcert start-trackingafter running
getcert request, because the
getcert requestcommand by default automatically tracks and renews the requested certificate. The
getcert start-trackingcommand is intended for situations when you have already obtained the key and certificate through some other process, and therefore you have to manually instruct
certmongerto start the tracking.
getcert start-trackingcommand takes several options:
-rautomatically renews the certificate when its expiration date is close if the key pair already exists. This option is used by default.
-Isets a name for the tracking request.
certmongeruses this name to refer to the combination of storage locations and request options, and it is also displayed in the output of the
getcert listcommand. If you do not specify this option,
certmongerassigns an automatically generated a name for the task.
[root@server ~]# getcert start-tracking -I cert1-tracker -d /export/alias -n ServerCert
To cancel tracking for a certificate, run the